It's common for outbound traffic to 127/8 to be blocked, at the application layer, to prevent SSRF. For example, in WordPress:

https://github.com/WordPress/WordPress/blob/9d4d3f8fba13be09...